fleet/fleetd
3
0
Fork 0
Code Issues 73 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

CB-172: block broker URI env from members #204

Closed
agent wants to merge 1 commits from worker/cb-172-broker-uri-d36ae4-4 into main
pull from: worker/cb-172-broker-uri-d36ae4-4
merge into: fleet:main
Conversation 1 Commits 1 Files Changed 8
+266 -24
agent commented 2026-08-31 09:06:19 +02:00
Member
Copy Link
Copy Source

Fixes #172. Config-derived broker and coordinator URI environment names are withheld from member panes under allow-list and deny-list policies. Includes regression proof and mvn clean install result in REPORT-cb172.md.

Fixes #172. Config-derived broker and coordinator URI environment names are withheld from member panes under allow-list and deny-list policies. Includes regression proof and mvn clean install result in REPORT-cb172.md.
agent added 1 commit 2026-08-31 09:06:19 +02:00
CB-172: block broker URI env from members
CI / build (pull_request) Successful in 1m13s
Details
CI / contract (pull_request) Successful in 1m14s
Details
ab26f45823
ltms commented 2026-08-31 17:06:46 +02:00
Owner
Copy Link
Copy Source

Already on main — closing as superseded, not rejected.

Every line of this PR's substance landed in ad587ea ("#172: keep the broker URI, password and all, out of every member pane"): MemberEnvAllowList.derive(..., excludedNames), brokerUriEnvNames(FleetConfig), the config supplier on HerdrPeerLauncher, the union into overlayBlockedCredentials, and the allowed.removeAll(brokerUriEnvNames) in derivedAllowedNames. The tests are on main too (6 assertions in MemberEnvAllowListTest, 4 in HerdrPeerLauncherAllowListWiringTest).

This branch now conflicts with main because it re-adds constructors main already has.

For the record, the coverage that landed is complete across all three spawn paths, which was the thing worth getting right here:

  • deny-by-default → overlayBlockedCredentials sentinel-overwrites the broker names.
  • allow-list, non-zsh fallback → same overlay, since applyEnvironmentAllowListPolicy calls it before returning.
  • allow-list, zsh → excluded from the derived set, and removeAll runs after allowed.addAll(launch.env().keySet()), so a name this spawn injects itself cannot smuggle it back in.

That last ordering detail is the one that would have been easy to get wrong.

Already on `main` — closing as superseded, not rejected. Every line of this PR's substance landed in `ad587ea` ("#172: keep the broker URI, password and all, out of every member pane"): `MemberEnvAllowList.derive(..., excludedNames)`, `brokerUriEnvNames(FleetConfig)`, the `config` supplier on `HerdrPeerLauncher`, the union into `overlayBlockedCredentials`, and the `allowed.removeAll(brokerUriEnvNames)` in `derivedAllowedNames`. The tests are on main too (6 assertions in `MemberEnvAllowListTest`, 4 in `HerdrPeerLauncherAllowListWiringTest`). This branch now conflicts with main because it re-adds constructors main already has. For the record, the coverage that landed is complete across all three spawn paths, which was the thing worth getting right here: - deny-by-default → `overlayBlockedCredentials` sentinel-overwrites the broker names. - allow-list, non-zsh fallback → same overlay, since `applyEnvironmentAllowListPolicy` calls it before returning. - allow-list, zsh → excluded from the derived set, and `removeAll` runs *after* `allowed.addAll(launch.env().keySet())`, so a name this spawn injects itself cannot smuggle it back in. That last ordering detail is the one that would have been easy to get wrong.
ltms closed this pull request 2026-08-31 17:06:53 +02:00
Some checks are pending
CI / build (pull_request) Successful in 1m13s
Details
CI / contract (pull_request) Successful in 1m14s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
blocked
Cannot start until something else lands. The body says what.
 needs-live-proof
Merged and green, but never shown working on the running daemon. Not the same as done.
 ready-to-delegate
Scope, files and acceptance criteria are written. A worker can be briefed from the body alone.
 silent-default
A feature that compiles, passes tests, and ships turned off. Nine recurrences and counting.
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent kevin ltms
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: fleet/fleetd#204
Delete Branch "worker/cb-172-broker-uri-d36ae4-4"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?